feat: add basic support for CDX 1.5 #488
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Johannes Feichtner <johannes@web-wack.at>
|
Thank you for your contribution, @Churro . 👍 I will review it soon |
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
jkowalleck
reviewed
Nov 27, 2023
jkowalleck
reviewed
Nov 27, 2023
Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
|
Thank you for refining and bringing this over the finish line 😊 |
jkowalleck
added a commit
that referenced
this pull request
Nov 28, 2023
This PR introduces basic support for CDX 1.5. Ref: - #404 **Schema:** - Extended schema-downloader and added specification files, - Adapted `README` and `SchemaVersion` for 1.5 **Model:** - Added `SchemaVersion1Dot5`, serializable annotations, - Extended `ComponentType` and `ExternalReferenceType` enums **Tests:** - Generated snapshots for 1.5. - In some existing tests `bom-ref` changed, since 1.5 is now listed before 1.4 **Chore:** - Added `newline = '\n'` to schema-downloader and `writeSnapshot` for cross-platform support ---- * feat: add basic support for CDX 1.5 Signed-off-by: Johannes Feichtner <johannes@web-wack.at> * docs: note minversions of `HashAlgorithm` cases Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * docs: set ref after schema download Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * refactor: add the newly missing/TODO elements Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * docs: note minversions of `ComponentType` cases Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * refactor: adjust xml child order for CDX1.5 Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * refactor: adjust xml child order for CDX1.5 Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * docs: update to latest CDX meta Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * refactor: adjust xml child order for CDX1.5 Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * feat: new enum cases fr VulnerabilityScoreSource Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * refactor: adjust xml child order for CDX1.5 Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * tests: adjust to latest implementation Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> * revert deletion by accident Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> --------- Signed-off-by: Johannes Feichtner <johannes@web-wack.at> Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> Co-authored-by: Jan Kowalleck <jan.kowalleck@gmail.com> Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Merged
Closed
jkowalleck
added a commit
that referenced
this pull request
Dec 10, 2023
### Breaking Changes * Removed symbols that were already marked as deprecated (via [#493]) * Removed symbols in `parser.*` ([#489] via [#495]) * Removed `output.LATEST_SUPPORTED_SCHEMA_VERSION` ([#491] via [#494]) * Serialization of unsupported enum values might downgrade/migrate/omit them ([#490] via [#496]) Handling might raise warnings if a data loss occurred due to omitting. The result is a guaranteed valid XML/JSON, since no (enum-)invalid values are rendered. * Serialization of any `model.component.Component` with unsupported `type` raises `exception.serialization.SerializationOfUnsupportedComponentTypeException` ([#490] via [#496]) * Object `model.bom_ref.BomRef`'s property `value` defaults to `Null`, was arbitrary `UUID` ([#504] via [#505]) This change does not affect serialization. All `bom-ref`s are guaranteed to have unique values on rendering. * Removed helpers from public API ([#503] via [#506]) ### Added * Basic support for CycloneDX 1.5 ([#404] via [#488]) * No data models were enhanced nor added, yet. Pull requests to add functionality are welcome. * Existing enumerable got new cases, to reflect features of CycloneDX 1.5 ([#404] via [#488]) * Outputters were enabled to render CycloneDX 1.5 ([#404] via [#488]) ### Tests * Created (regression/unit/integration/functional) tests for CycloneDX 1.5 ([#404] via [#488]) * Created (regression/functional) tests for Enums' handling and completeness ([#490] via [#496]) ### Misc * Bumped dependency `py-serializable@^0.16`, was `@^0.15` (via [#496]) ---- ### API Changes — the details for migration * Added new sub-package `exception.serialization` (via [#496]) * Removed class `models.ComparableTuple` ([#503] via [#506]) * Enum `model.ExternalReferenceType` got new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488]) * Removed function `models.get_now_utc` ([#503] via [#506]) * Removed function `models.sha1sum` ([#503] via [#506]) * Enum `model.component.ComponentType` got new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488]) * Removed `model.component.Component.__init__()`'s deprecated optional kwarg `namespace` (via [#493]) Use kwarg `group` instead. * Removed `model.component.Component.__init__()`'s deprecated optional kwarg `license_str` (via [#493]) Use kwarg `licenses` instead. * Removed deprecated method `model.component.Component.get_namespace()` (via [#493]) * Removed class `models.dependency.DependencyDependencies` ([#503] via [#506]) * Removed `model.vulnerability.Vulnerability.__init__()`'s deprecated optional kwarg `source_name` (via [#493]) Use kwarg `source` instead. * Removed `model.vulnerability.Vulnerability.__init__()`'s deprecated optional kwarg `source_url` (via [#493]) Use kwarg `source` instead. * Removed `model.vulnerability.Vulnerability.__init__()`'s deprecated optional kwarg `recommendations` (via [#493]) Use kwarg `recommendation` instead. * Removed `model.vulnerability.VulnerabilityRating.__init__()`'s deprecated optional kwarg `score_base` (via [#493]) Use kwarg `score` instead. * Enum `model.vulnerability.VulnerabilityScoreSource` got new cases, to reflect features for CycloneDX 1.5 ([#404] via [#488]) * Removed `output.LATEST_SUPPORTED_SCHEMA_VERSION` ([#491] via [#494]) * Removed deprecated function `output.get_instance()` (via [#493]) Use function `output.make_outputter()` instead. * Added new class `output.json.JsonV1Dot5`, to reflect CycloneDX 1.5 ([#404] via [#488]) * Added new item to dict `output.json.BY_SCHEMA_VERSION`, to reflect CycloneDX 1.5 ([#404] via [#488]) * Added new class `output.xml.XmlV1Dot5`, to reflect CycloneDX 1.5 ([#404] via [#488]) * Added new item to dict `output.xml.BY_SCHEMA_VERSION`, to reflect CycloneDX 1.5 ([#404] via [#488]) * Removed class `parser.ParserWarning` ([#489] via [#495]) * Removed class `parser.BaseParser` ([#489] via [#495]) * Enum `schema.SchemaVersion` got new case `V1_5`, to reflect CycloneDX 1.5 ([#404] via [#488]) [#404]: #404 [#488]: #488 [#489]: #489 [#490]: #490 [#491]: #491 [#493]: #493 [#494]: #494 [#495]: #495 [#496]: #496 [#503]: #503 [#504]: #504 [#505]: #505 [#506]: #506 --------- Signed-off-by: Johannes Feichtner <johannes@web-wack.at> Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com> Signed-off-by: semantic-release <semantic-release> Co-authored-by: Johannes Feichtner <343448+Churro@users.noreply.github.com> Co-authored-by: semantic-release <semantic-release>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR introduces basic support for CDX 1.5.
Ref:
Schema:
READMEandSchemaVersionfor 1.5Model:
SchemaVersion1Dot5, serializable annotations,ComponentTypeandExternalReferenceTypeenumsTests:
bom-refchanged, since 1.5 is now listed before 1.4Chore:
newline = '\n'to schema-downloader andwriteSnapshotfor cross-platform support